Breaking the Attack Chain: Exploiting Structural Blindspots in Modern IT Operations
Corey Ham and Matt Eidelberg analyze why targeted attack chains succeed, exploiting systemic blindspots between IT operations and security monitoring.
Summary
The Friction Between IT Administration and Security Controls
Even in mature enterprise environments, operational compromises made for business convenience create structural blindspots that red teams routinely exploit.
Dissecting Realistic Attack Chains from Initial Access to Domain Takeover
Corey Ham and Matt Eidelberg walk through full attack chains—abusing service accounts, shared local administrator passwords, and unmonitored legacy subnets.
Exploiting Administrative Tooling for Living-Off-The-Land
The speakers illustrate how adversaries turn legitimate management tools (PowerShell remoting, WMI, PsExec) into covert lateral movement vectors.
Actionable Strategies for Breaking the Attack Chain
The authors present practical architectural reforms—including Tiered Administration, privileged access workstations, and focused telemetry auditing.
Related talks
Password Village·13 min
EvilMog
Demonstrates pivoting from compromised networked printers into Active Directory environments to forge Kerberos silver tickets.
Password Village·12 min
EvilMog
Walks through exploiting embedded printer credentials to pivot across domain infrastructure and mint silver tickets.
Main Track 1·47 min
Chris Thompson
Evaluates Windows Defender ATP and Microsoft Advanced Threat Analytics detection mechanisms and presents tradecraft for red teams to evade behavioral telemetry.